strongSwan ilaa AWS Site-to-Site: sababta Child SA uusan waxba u dooran

Tunnel IKE wuu shaqayn karaa iyadoo xiriirka ilmaha uu ka reebayo subnet-yadaada. Marka hore isbarbardhig CIDR-ka gudaha iyo kan fog ee AWS leftsubnet iyo rightsubnet.

Console-ku waxa uu muujinayaa up, strongSwan waxa uu soo sheegayaa xiriir IKE la aasaasay, pakaduhuna wali ma yimaadaan. Waxa xiga ee la isbarbardhigayo ma aha furaha horay loo wadaagay, balse waa lammaanaha horgalayaasha ee dhinac kastaa uu qabo in tunnel-ku difaacayo. Ku soco hubinta hoose si taxane ah, sababtoo ah labada hore waxay go'aamiyaan in tunnel-ku uu gudbin karo taraafikadaada ama maya.

U tarjun magacyada AWS una beddel ereyada strongSwan

AWS waxa ay sharraxdaa xiriirka dhinaca macmiilka: ciwaanka gateway-ga macmiilka iyo CIDR-ka gudaha adigaa leh, CIDR-ka fog-na VPC-gaa leeyahay. strongSwan waxa uu labada daraf ugu yeedhaa left iyo right, horgalahaaga wuxuu ku jiraa leftsubnet, horgalaha VPC-na wuxuu ku jiraa rightsubnet. Haddii aad hal lammaane rogto, waxa aad helaysaa tunnel kala xaajooda oo dooranaya taraafikada qaldan.

Soo dejiso casharka AWS u abuurayo xiriirka oo u qaado tixraac u gaar ah xiriirkaas, oo ay ku jiraan ciwaannada iyo horgalayaasha tunnel-ka. Haddii aad labada goobood ee CIDR madhan ka tagto marka la abuurayo, adeeggu waxa uu isticmaalaa 0.0.0.0/0 oo caadi ah dhinac kasta. Router lagu habayay horgale cidhiidhi ah markaas marnaba lama mid noqon doono, sidaas darteed ama buuxi goobaha ama si ula kac ah u ballaadhi dooraha.

Halkan isma-afgaradku waxa uu u eg yahay guuldarro marin, mana aha.

Xajiso ciwaanka AWS uu dhab ahaan arko

Router ka dambeeya NAT waxa uu IKE ka soo dirayaa interface-ka dhinaca kale aan marnaba aqoon. Ciwaanka gateway-ga lagu diiwaangeliyay AWS waa in uu yahay kan AWS ku arko shabakadda, router-kana waa in lagu xajiyo isla ciwaankaas gudaha halkii uu raaci lahaa waddadiisa caadiga ah.

conn %default
    local_addrs = 203.0.113.10

strongSwan gudahiisa local_addrs waxa uu dooranayaa ciwaanka isha IKE, casharradii hore ee OpenSwan-na isla fikraddaas waxa ay u qoraan left. U jeedi interface-ka haysta ciwaanka guud, ka dibna NAT-ka qudhiisa ku hubi in UDP 500 iyo 4500 ay gaadhaan martidaas, sababtoo ah xeer ka hadhay router hore ayaa si aamusnaan ah u tuuraya. Lammaanaha doorayaasha saxda ah oo leh ciwaan isha khaldan weli wuu guuldarraystaa, diiwaankuna waxa uu eedayn doonaa soo jeedinta. Jahawareerkaas ayaa sababta ciwaanka ishu u mudan yahay hubin u gaar ah.

Xaqiiji xeerka gudbinta halkii aad ka fikiri lahayd, sababtoo ah xeer ku habboonaa router-kii hore ayaa inta badan hadha.

Si gooni ah u maamul wajiga 1 iyo wajiga 2

AWS waxa uu tusaa xulashooyinka IKE iyo ESP sidii liisas gooni ah. Qaybta IKE ee labada dhinac ay aqbalaan waxba kama sheegto soo jeedinta ESP, sababtoo ah labada liis waa madax-bannaan. Labadaba ka akhri casharka la abuuray oo mid mid u barbardhig.

conn aws
    ike = aes256-sha1-modp1024
    esp = aes256gcm16

Qoraallada isku-dhismeedka kuma safraan fulinta dhexdooda. Lammaane ka shaqeeya OpenSwan, tusaale ahaan phase2alg=aes_gcm oo la socda ike=aes256-sha1;modp1024, waxa loo baahan yahay in loo tarjumo qaabka esp= iyo ike= ee strongSwan, magacyada algorithm-na way kala duwan yihiin. Maaddaama GCM uu xaqiijiyo inta uu sireeyo, uma baahna beddelaad daacadnimo gooni ah, si ka duwan qaybta CBC oo lammaane la SHA. Sadarka wajiga 2 ee laga dhejiyay hal daemon una guuray mid kale iyada oo aan la tarjunin waxa uu abuuraa diidmo u akhranaysa sida isma-afgaradka doorayaasha.

Hubi xiriirka ilmaha, ma aha tilmaamaha tunnel-ka

Haddii xiriirku raranto laakiin aan xiriir ilmo soo bixin, waxa la diiday soo jeedinta ama doorayaasha. Haddii ilmo soo baxo oo doorayaashiisu ka reebaan horgalayaashaada, pakadaha waa la shaandheeyaa ka hor inta aysan gaadhin tunnel-ka. Tilmaamaha console-ku waxa uu daboolaa heerka IKE oo keliya, sidaas darteed ma sheegi karo midka labada dhacay.

ipsec statusall

Raadi xiriirka amni ee ilmaha oo akhri doorayaasha taraafikada ee agtiisa lagu daabacay, ka dibna la barbardhig horgalayaasha casharka la abuuray.

Ka tijaabi marti ku jirta horgalaha gudaha una socota marti ku jirta horgalaha VPC, oo hubi wadada soo noqodka iyo koox kasta oo amni ama ACL shabakadeed oo dhinaca AWS ah. Doorayaasha saxda ah kama difaacaan pakad in markii dambe la tuuro.

Marka ay weli guuldarraysto ka dib marka doorayaashu is waafaqaan

Xaqiiji in wadada labada dhinac ay u jeeddo tunnel-ka, ka dibna xaqiiji in qalabka NAT uusan dib u qorayn taraafikada si aan siyaasaddu filaynin. Tunnel ku salaysan siyaasaddu waxa uu isbarbardhigaa ciwaannada pakadaha, sidaas darteed tarjumaad la isticmaalay ka dib go'aanka siyaasadda ayaa natiijada beddela.

Diiwaangeli hal pakad soo galay iyo hal ka baxay dhinac kasta ka hor inta aadan beddelin soo jeedin kale.

Ku qor doorayaasha, soo jeedimaha wajiga 1 iyo wajiga 2 iyo ciwaanka isha tigidhka. Afartan qiimayaal waxay sharraxaan inta badan guuldarrooyinka site-to-site iyada oo aan la wicin.

Maqaallo la xiriira